receiveTokenOrETH() does not check the useless msg.value, which may cause the loss of funds

[code423n4]

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/LineLib.sol#L68

Vulnerability details

Impact

LineLib#receiveTokenOrETH() does not check the useless msg.value, which may cause the loss of funds

Proof of Concept

When token != Denominations.ETH, msg.value is not used, but there is no detection of msg.value==0, so if it is transferred by mistake, the funds will be lost.

    function receiveTokenOrETH(
      address token,
      address sender,
      uint256 amount
    )
      external
      returns (bool)
    {
        if(token == address(0)) { revert TransferFailed(); }
        if(token != Denominations.ETH) { // ERC20
            //****@audit  not check msg.value ==0 if it is transferred by mistake ****/
            IERC20(token).safeTransferFrom(sender, address(this), amount);
        } else { // ETH
            if(msg.value < amount) { revert TransferFailed(); }
        }
        return true;
    }

Tools Used

Recommended Mitigation Steps

    function receiveTokenOrETH(
      address token,
      address sender,
      uint256 amount
    )
      external
      returns (bool)
    {
        if(token == address(0)) { revert TransferFailed(); }
        if(token != Denominations.ETH) { // ERC20
+          require(msg.value==0,"msg.value>0");
            IERC20(token).safeTransferFrom(sender, address(this), amount);
        } else { // ETH
            if(msg.value < amount) { revert TransferFailed(); }
        }
        return true;
    }

[c4-judge]

dmvt marked the issue as duplicate of #89

[c4-judge]

dmvt marked the issue as satisfactory

[C4-Staff]

liveactionllama marked the issue as duplicate of #355